Privacy Policy

1. Introduction

Grape Software Limited (“Grape Software“, “we“, “our” or “us“) is committed to protecting the privacy and security of the personal information we collect and process.

We develop and operate digital software solutions for regulatory inspections, compliance management and food safety, including INSPECT™, our inspection and audit management platform, and PREPARE™, our compliance and business management platform.

We recognise the importance of protecting personal information and are committed to processing personal data fairly, lawfully and transparently in accordance with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Data (Use and Access) Act 2025
• Privacy and Electronic Communications Regulations (PECR)
• Any other applicable UK data protection legislation.

This Privacy Policy explains:

• what personal information we collect;
• why we collect it;
• our lawful basis for processing;
• how we use and protect it;
• who we share it with;
• how long we keep it;
• your legal rights; and
• how to contact us regarding privacy matters.

By using our website or services you acknowledge that your information will be processed as described within this Privacy Policy.

2. Who We Are

Grape Software Limited is a software company specialising in digital inspection, compliance and food safety management solutions.

Registered Company Name: Grape Software Limited

Company Number: 12524204

Registered Office: Salvus House, Aykley Heads, Durham, County Durham, United Kingdom, DH1 5TS

Correspondence Address: Salvus House, Aykley Heads, Durham, County Durham, United Kingdom, DH1 5TS

Website: https://grapesoftware.co.uk

General Enquiries: Contact us

Privacy Enquiries: Contact us

ICO Registration Number: ZB006321

Where Grape Software determines the purposes and means of processing personal information, we act as the Data Controller.

Where we process information solely on behalf of one of our customers, such as a Local Authority or other organisation using our software, we act as a Data Processor.

3. Scope of this Privacy Policy

This Privacy Policy applies to personal information processed through:

• the Grape Software website;
• INSPECT™;
• PREPARE™;
• customer support services;
• demonstrations and free trials;
• webinars and events;
• marketing communications;
• supplier relationships;
• recruitment activities;
• prospective customer enquiries.

This Privacy Policy applies to:

• website visitors;
• Local Authority employees;
• Environmental Health Officers;
• contractors;
• consultants;
• food business operators;
• registered users;
• prospective customers;
• suppliers;
• business contacts.

This Privacy Policy does not apply to third-party websites or services that may be linked from our website.

4. Definitions

For the purposes of this Privacy Policy:

Personal Data

Any information relating to an identified or identifiable living individual.

Processing

Any operation performed on personal data including collection, recording, storage, retrieval, use, disclosure, deletion or destruction.

Data Controller

The organisation that determines why and how personal information is processed.

Data Processor

An organisation that processes personal information on behalf of a Data Controller.

Customer

Any organisation licensing or using our software, including Local Authorities, inspection organisations, contractors or commercial businesses.

User

Any authorised individual using INSPECT™, PREPARE™ or related services.

Inspection Data

Information recorded during inspections, audits or compliance activities.

Website

The Grape Software website located at: https://grapesoftware.co.uk

5. Our Role as Data Controller and Data Processor

The role Grape Software performs depends upon the service being provided.

5.1 When we are the Data Controller

We act as Data Controller for information relating to:

• website visitors;
• enquiries;
• customer accounts;
• software licensing;
• billing;
• marketing communications;
• webinars and events;
• recruitment;
• supplier relationships;
• support requests.

For these activities we determine why personal information is collected and how it is processed.

5.2 When we are the Data Processor

INSPECT™ and PREPARE™ allow organisations to collect, manage and retain compliance information.

Where a customer uploads or records information using our software, Grape Software generally processes that information only on behalf of that customer.

Examples include:

• Local Authorities
• Inspection Bodies
• Environmental Health departments
• Contractors
• Commercial businesses using PREPARE™

In these situations, the customer remains the Data Controller and is responsible for determining:

• what personal information is collected;
• why it is collected;
• who can access it;
• how long it is retained;
• when it should be deleted.

Grape Software processes this information only in accordance with the customer’s documented instructions and applicable contractual agreements.

If you wish to exercise your data protection rights in relation to inspection information held by one of our customers, you should normally contact the relevant organisation directly.

Where appropriate, Grape Software will assist our customers in responding to such requests.

6. Personal Information We Collect

The categories of information we collect depend upon how you interact with Grape Software.

6.1 Identity Information

Examples include:

• name;
• title;
• employer;
• organisation;
• job title;
• username.

6.2 Contact Information

Examples include:

• email address;
• telephone number;
• postal address;
• business address.

6.3 Account Information

Including:

• account identifiers;
• login details;
• password (encrypted where applicable);
• authentication information;
• user preferences;
• permissions;
• profile settings.

6.4 Inspection and Compliance Information

Where our customers use INSPECT™ or PREPARE™ this may include:

• inspection records;
• audit findings;
• compliance notes;
• actions;
• recommendations;
• photographs;
• uploaded evidence;
• signatures;
• reports;
• attachments;
• risk assessments;
• compliance history.

This information is usually processed on behalf of our customers.

6.5 Technical Information

Including:

• IP address;
• browser type;
• operating system;
• device identifiers;
• session information;
• application logs;
• error reports;
• usage analytics.

6.6 Financial Information

Where applicable:

• billing contact details;
• invoices;
• payment references;
• transaction history.

Payment card information is generally processed by our authorised payment providers and is not stored by Grape Software.

6.7 Communications

Including:

• emails;
• support tickets;
• webinar registrations;
• feedback;
• survey responses;
• telephone call notes.

7. How We Collect Personal Information

We collect personal information in a number of ways.

7.1 Information You Provide

You may provide information when you:

• register for an account;
• request a demonstration;
• contact us;
• submit an enquiry;
• attend a webinar;
• subscribe to updates;
• request support;
• complete surveys;
• enter into a contract.

7.2 Information Collected Automatically

When you use our website or software we may automatically collect technical information including:

• browser information;
• device information;
• IP address;
• pages visited;
• system logs;
• performance information.

7.3 Information Provided by Customers

Where our software is used by organisations, personal information may be uploaded into our systems by authorised users acting on behalf of those organisations.

7.4 Third Parties

We may receive information from:

• authorised resellers;
• integration partners;
• identity providers;
• payment providers;
• event organisers;
• publicly available sources where appropriate.

8. Lawful Basis for Processing

We only process personal information where we have a lawful basis under UK GDPR.

Where we rely upon consent, you may withdraw that consent at any time.

Where we rely upon legitimate interests, we ensure those interests are balanced against the rights and freedoms of individuals.

9. How We Use Personal Information

We use personal information to:

• provide and maintain our software services;
• create and manage user accounts;
• authenticate users;
• provide technical support;
• deliver contracted services;
• communicate with customers;
• process enquiries;
• improve our products;
• maintain system security;
• detect fraud;
• monitor performance;
• administer customer licences;
• process payments;
• meet legal obligations;
• comply with regulatory requirements;
• respond to legal requests;
• send service notifications;
• deliver webinars and demonstrations;
• improve user experience.

We will only use personal information for purposes that are compatible with the reason it was originally collected unless we are required or permitted by law to do otherwise.

10. INSPECT™

INSPECT™ is designed for inspection authorities, regulators, contractors and other authorised organisations undertaking inspections and compliance activities.

Depending upon how INSPECT™ is deployed, Grape Software generally acts as a Data Processor.

The organisation using INSPECT™ remains responsible for determining what information is collected during inspections.

Information processed within INSPECT™ may include:

• inspector details;
• business contact information;
• inspection findings;
• inspection dates;
• inspection reports;
• compliance actions;
• photographs;
• uploaded documents;
• signatures;
• audit history;
• enforcement notes;
• compliance history.

Grape Software does not determine the content of inspection records created by our customers.

If an individual wishes to exercise their rights relating to inspection records, requests should normally be directed to the organisation responsible for carrying out the inspection.

11. PREPARE™

PREPARE™ is designed to assist businesses in managing food safety, compliance and operational records.

Depending upon how PREPARE™ is configured, Grape Software may act either as:

• Data Controller; or
• Data Processor.

Information processed within PREPARE™ may include:

• business owner information;
• employee details;
• user accounts;
• food safety documentation;
• compliance records;
• uploaded evidence;
• training records;
• inspection history;
• corrective actions;
• audit documentation.

The precise categories of information processed depend upon the modules licensed and used by the customer.

12. Website Visitors

When you visit our website we may automatically collect technical information to help us operate, maintain and improve our services.

This may include:

• IP address;
• browser type;
• operating system;
• referring website;
• pages viewed;
• session duration;
• device type;
• approximate location derived from IP address.

Where cookies requiring consent are used, we will request your consent before placing them on your device.

Our website may also generate server logs for security, troubleshooting and fraud prevention purposes.

We do not knowingly collect personal information from children under the age of 13 through our website.

Further information regarding cookies can be found here.

13. Marketing Communications

We may contact you with information about our products, services, events, webinars, software updates, industry news and other information that may be relevant to your organisation.

Marketing communications may include:

• product announcements;
• feature releases;
• software updates;
• webinar invitations;
• newsletters;
• event invitations;
• customer surveys;
• promotional offers.

We will only send marketing communications where we have a lawful basis to do so.

This may include:

• your consent;
• where you have requested information from us;
• where your organisation is an existing customer and we believe the information is relevant to the products or services you already use, where permitted by law.

You may unsubscribe from marketing communications at any time by:

• clicking the unsubscribe link contained within our emails;
• contacting us using the details provided within this Privacy Policy; or
• updating your communication preferences where this functionality is available.

Please note that even if you opt out of marketing communications, we may still contact you regarding:

• software licences;
• service updates;
• account administration;
• security notifications;
• contractual matters;
• support requests;
• legal or regulatory obligations.

These communications are considered service communications rather than marketing.

14. Cookies and Website Analytics

Our website uses cookies and similar technologies to improve functionality, understand website usage and provide a better user experience.

Cookies are small text files stored on your device when you visit a website.

Depending upon your preferences, cookies may be used to:

• remember your preferences;
• maintain secure login sessions;
• analyse website performance;
• improve navigation;
• monitor website traffic;
• identify technical issues.

Cookies generally fall into the following categories.

14.1 Strictly Necessary Cookies

These cookies are essential for the operation of our website and cannot normally be disabled.

Examples include:

• authentication;
• session management;
• security;
• load balancing.

The lawful basis for these cookies is our legitimate interest in operating a secure website.

14.2 Functional Cookies

These cookies remember choices you make to improve your browsing experience.

Examples include:

• language preferences;
• accessibility settings;
• saved preferences.

These cookies may require your consent depending upon how they are implemented.

14.3 Analytics Cookies

We may use website analytics services to help us understand:

• visitor numbers;
• popular pages;
• user journeys;
• browser types;
• device types;
• website performance.

Analytics information is generally aggregated and used to improve our website and services.

Where analytics cookies require consent, they will only be placed after your consent has been obtained.

14.4 Managing Cookies

Most web browsers allow you to:

• delete cookies;
• block cookies;
• receive notifications before cookies are stored.

Disabling certain cookies may affect the functionality of our website.

Further details are available within our separate Cookie Policy.

15. Sharing Your Information

We do not sell personal information.

We only disclose personal information where necessary for legitimate business purposes, contractual performance, legal compliance or where you have requested us to do so.

Information may be shared with the following categories of recipients.

15.1 Service Providers

Including providers of:

• cloud hosting;
• infrastructure services;
• authentication services;
• email delivery;
• payment processing;
• customer support;
• website hosting;
• monitoring services;
• backup services;
• telecommunications;
• webinar platforms.

These providers only process personal information under contractual obligations requiring appropriate security and confidentiality.

15.2 Our Customers

Where Grape Software acts as a Data Processor, authorised users within the customer organisation will have access to information entered into INSPECT™ or PREPARE™.

Examples include:

• Local Authorities;
• inspection organisations;
• contractors;
• commercial customers.

15.3 Professional Advisers

We may share information where necessary with:

• solicitors;
• accountants;
• auditors;
• insurers;
• professional consultants.

15.4 Regulators and Public Authorities

We may disclose information where required to comply with:

• legislation;
• court orders;
• lawful requests;
• regulatory investigations;
• law enforcement requirements.

15.5 Business Transfers

If Grape Software undergoes:

• a merger;
• acquisition;
• investment;
• restructuring;
• sale of assets;

personal information may be transferred as part of that transaction, subject to appropriate confidentiality obligations.

We require all third parties processing personal information on our behalf to:

• maintain appropriate security;
• process information only under our documented instructions;
• comply with applicable data protection legislation;
• implement suitable technical and organisational safeguards.

16. International Transfers

We primarily store and process personal information within the United Kingdom.

Some of our service providers may process information outside the UK.

Where personal information is transferred internationally, we will ensure that appropriate safeguards are in place.

These safeguards may include:

• UK International Data Transfer Agreements (IDTAs);
• the UK Addendum to the European Commission Standard Contractual Clauses;
• transfers to countries recognised by the UK Government as providing an adequate level of protection;
• other lawful transfer mechanisms permitted under UK data protection legislation.

Before transferring personal information internationally we assess whether appropriate technical, contractual and organisational safeguards are in place.

Where you would like further information regarding international transfers, please contact us using the details contained within this Privacy Policy.

17. Data Security

Protecting personal information is fundamental to the way we design and operate our services.

We implement a range of technical and organisational measures designed to protect information against:

• unauthorised access;
• accidental loss;
• unlawful destruction;
• alteration;
• misuse;
• disclosure.

Our security measures may include:

• encrypted communications using HTTPS/TLS;
• secure cloud hosting;
• role-based access controls;
• user authentication;
• strong password requirements;
• multi-factor authentication where available;
• audit logging;
• regular software updates;
• vulnerability management;
• malware protection;
• secure backup procedures;
• disaster recovery arrangements;
• staff confidentiality obligations;
• security monitoring.

Access to personal information is limited to authorised personnel who require access to perform their duties.

Although we implement appropriate safeguards, no method of electronic transmission or storage can be guaranteed to be completely secure.

Where we become aware of a personal data breach, we will respond in accordance with our legal obligations and, where required, notify the Information Commissioner’s Office and affected individuals.

18. Data Retention

We only retain personal information for as long as necessary to fulfil the purposes for which it was collected, to comply with legal obligations, resolve disputes and enforce contractual rights.

Retention periods depend upon the type of information being processed.

18.1 INSPECT™ and PREPARE™ Records

Inspection records and compliance information stored within INSPECT™ or PREPARE™ are generally retained in accordance with the instructions of the relevant customer acting as Data Controller.

Where Grape Software acts as a Data Processor, we do not determine the retention period for customer inspection records unless expressly agreed within our contractual arrangements.

Following termination of customer services, information will be securely returned, deleted or anonymised in accordance with contractual requirements and applicable legislation.

Retention periods may be extended where necessary to:

• establish legal claims;
• defend legal claims;
• comply with statutory obligations;
• investigate fraud;
• comply with lawful requests from regulators or law enforcement agencies.

19. Your Rights

Under UK data protection legislation you have a number of important rights regarding your personal information.

These rights are not absolute and may be subject to certain legal exemptions.

Your rights include:

19.1 Right to be Informed

You have the right to understand how your personal information is collected and used.

This Privacy Policy forms part of that obligation.

19.2 Right of Access

You may request confirmation of whether we process your personal information and obtain a copy of that information.

19.3 Right to Rectification

You may request correction of inaccurate or incomplete personal information.

19.4 Right to Erasure

In certain circumstances you may request that your personal information be deleted.

Further details are provided later within this Privacy Policy.

19.5 Right to Restrict Processing

You may ask us to temporarily restrict the processing of your personal information under certain circumstances.

19.6 Right to Data Portability

Where applicable, you may request that your personal information be provided in a structured, commonly used and machine-readable format.

19.7 Right to Object

You may object to certain types of processing, including direct marketing.

19.8 Rights Relating to Automated Decision-Making

Where applicable, you have rights in relation to decisions made solely by automated means that produce legal or similarly significant effects.

At the time of publication of this Privacy Policy, Grape Software does not make decisions about individuals solely through automated processing that produce legal or similarly significant effects.

19.9 Right to Withdraw Consent

Where processing is based upon consent, you may withdraw that consent at any time.

Withdrawal of consent will not affect processing already carried out before consent was withdrawn.

20. Subject Access Requests

You have the right to request access to the personal information we hold about you.

This is commonly referred to as a Subject Access Request (SAR).

Requests may be submitted by:

• email;
• post;
• other written communication.

Please provide sufficient information to enable us to identify you and locate the relevant information.

We may request proof of identity before disclosing personal information.

We will normally respond to Subject Access Requests within one calendar month, although this period may be extended where permitted by law due to the complexity or volume of requests.

There is generally no fee for making a Subject Access Request.

However, where requests are manifestly unfounded, excessive or repetitive, we may:

• charge a reasonable administrative fee; or
• refuse the request where permitted by law.

Where Grape Software acts solely as a Data Processor, we will normally refer your request to the relevant Data Controller responsible for determining how the information is processed.

We will provide reasonable assistance to our customers in responding to Subject Access Requests where required under our contractual obligations.

Subject Access Requests and other privacy-related enquiries should be directed to:

Submit a privacy request

We will acknowledge receipt of your request as soon as reasonably practicable and keep you informed throughout the process where further clarification or identification is required.

21. Right to Erasure (“Right to be Forgotten”)

You have the right to request that your personal information be erased in certain circumstances.

This right is commonly referred to as the “Right to be Forgotten.”

You may request deletion where:

• the personal information is no longer required for the purpose for which it was collected;
• you withdraw your consent where consent is the lawful basis for processing;
• you successfully object to processing based upon legitimate interests;
• the information has been processed unlawfully;
• we are required to erase the information to comply with a legal obligation.

The right to erasure is not absolute.

We may be required to retain certain information where processing remains necessary for reasons including:

• compliance with legal obligations;
• establishment, exercise or defence of legal claims;
• public interest;
• archiving obligations;
• regulatory requirements;
• contractual obligations.

Where Grape Software acts solely as a Data Processor, requests relating to inspection records, audit records or customer-held information will normally be referred to the relevant Data Controller responsible for that information.

Where appropriate, we will assist our customers in responding to erasure requests in accordance with our contractual obligations.

22. Right to Restrict Processing

You have the right to request that we restrict the processing of your personal information in certain circumstances.

Examples include where:

• you believe the information is inaccurate;
• the processing is unlawful but you do not wish the information to be deleted;
• we no longer require the information but you require it for legal claims;
• you have objected to processing and we are considering that objection.

Where processing is restricted, we may continue to store the information but will generally not process it further unless:

• you consent;
• it is necessary for legal claims;
• it is required to protect the rights of another individual;
• it is required for important public interest reasons.

23. Right to Object and Data Portability

23.1 Right to Object

You have the right to object to certain types of processing carried out by Grape Software.

In particular, you may object where processing is based upon:

• legitimate interests;
• public interest;
• direct marketing.

Where you object to direct marketing, we will stop processing your personal information for those purposes.

Where processing is based upon legitimate interests, we will carefully consider your objection and determine whether our legitimate grounds override your rights and freedoms.

23.2 Right to Data Portability

Where processing is:

• based upon your consent or a contract; and
• carried out by automated means,

you may request a copy of your personal information in a structured, commonly used and machine-readable format.

Where technically feasible and legally permitted, you may also request that this information be transferred directly to another organisation.

This right does not generally apply where processing is carried out in the exercise of official authority or where Grape Software acts solely as a Data Processor on behalf of another organisation.

24. Privacy Complaints Procedure

We take privacy and data protection seriously and encourage individuals to contact us if they have any concerns regarding the way we process personal information.

If you believe your personal information has been handled incorrectly, you may submit a complaint by contacting our Privacy Team using the contact details provided within this Privacy Policy.

When making a complaint, please provide:

• your name and contact details;
• details of the concern;
• any relevant dates;
• supporting information where available.

Upon receiving a complaint we will:

• acknowledge receipt as soon as reasonably practicable;
• investigate the matter fairly and objectively;
• request additional information where necessary;
• respond within a reasonable timeframe; and
• explain any actions taken.

Where appropriate, we will work with you to resolve concerns promptly and transparently.

Where Grape Software acts solely as a Data Processor, we may refer your complaint to the relevant Data Controller responsible for determining how the information has been processed.

25. Complaints to the Information Commissioner’s Office (ICO)

If you remain dissatisfied with our response, or believe we have processed your personal information unlawfully, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s independent authority responsible for upholding information rights.

We encourage you to contact us first so that we have the opportunity to investigate and resolve your concerns.

Further information about making a complaint to the ICO is available from:

Information Commissioner’s Office

Website:

https://ico.org.uk/

Telephone:

0303 123 1113

Address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

You also have the right to seek a judicial remedy where you believe your rights under applicable data protection legislation have been infringed.

26. Children’s Privacy

Our website, products and services are designed for use by businesses, public sector organisations and authorised professionals.

They are not intended for children.

We do not knowingly collect personal information directly from children under the age of 13 through our website or services.

Where we become aware that personal information relating to a child has been collected without appropriate legal authority, we will take reasonable steps to delete that information where required by law.

Where customers use INSPECT™ or PREPARE™ to record information relating to children as part of their own statutory or regulatory functions, Grape Software processes that information solely on behalf of the relevant Data Controller and does not determine the purpose or lawful basis for that processing.

27. Third-Party Websites and Services

Our website and software may contain links to third-party websites, services or applications for your convenience.

Examples may include:

• government websites;
• legislation resources;
• regulatory guidance;
• customer websites;
• social media platforms;
• webinar providers;
• mapping services;
• authentication providers.

This Privacy Policy applies only to Grape Software and our products.

We are not responsible for the privacy practices, content or security of third-party websites or services.

We encourage you to review the privacy notices of any third-party services you choose to visit.

28. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to legislation;
• regulatory guidance;
• changes to our products or services;
• improvements to our privacy practices;
• changes to technology;
• organisational changes.

The most recent version of this Privacy Policy will always be published on our website.

Where changes are significant, we may also notify customers by:

• email;
• software notifications;
• customer communications; or
• other appropriate means.

Your continued use of our website or services following publication of an updated Privacy Policy constitutes acknowledgement of the revised policy.

Contact Us

If you have any questions regarding this Privacy Policy or how Grape Software processes personal information, please contact us.

Privacy Team

Grape Software Limited

Company Number: 12524204

Registered Office: Salvus House, Aykley Heads, Durham, County Durham, United Kingdom, DH1 5TS

Correspondence Address: Salvus House, Aykley Heads, Durham, County Durham, United Kingdom, DH1 5TS

Website: https://grapesoftware.co.uk

General Enquiries: Contact us

Privacy Enquiries: Contact us

ICO Registration Number: ZB006321

Website: https://grapesoftware.co.uk